Malicious code in dependent-final (npm)

Part of a self-republishing campaign: the package ships test.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry...